How Onguard keeps your credit management software safe
You can’t see security. But you can feel it: in the peace of mind that your data is protected, your customers are safe, and your systems keep running no matter what. At Onguard, that sense of security doesn’t happen by accident. It’s built, tested, monitored and continuously improved by the people behind the screens, like Davey Heisen and Marc van Loon, the duo leading Onguard’s security operations.
As part of Visma’s Application Security Programme (VASP), Onguard has achieved Platinum level for its CreditManager and CreditNext, the highest security standard within the Visma Group. But for Davey and Marc, this achievement is about far more than certificates. It’s about trust.
“People make mistakes, systems don’t,” Davey says. “So we focus on building technical controls that prevent issues before they happen. Think of it like putting a fence instead of a ‘Do not enter’ sign.”
What does credit management software security look like behind the scenes?
For most finance professionals, security sits quietly in the background, until something goes wrong. But at Onguard, it’s part of the daily routine.
“There’s no such thing as a typical day,” Marc laughs. “We check global threat news, respond to customer questionnaires, and support colleagues internally. It’s proactive and reactive at the same time: a cat-and-mouse game between hackers and defenders.”
Onguard’s security team runs on both threat intelligence (staying ahead of emerging risks) and continuous monitoring, ensuring vulnerabilities are detected before they become problems.
The team also benefits from Visma’s 24/7 Global Security Operations Center (GSOC). “If something suspicious happens at 2 a.m., someone is watching,” Davey explains. “If it’s serious, we get a call, but thanks to Visma’s security team, we know someone’s always got our back.”
How does ISO 27001:2022 certification strengthen credit management security?
In 2025, Onguard successfully completed the ISO 27001:2022 re-certification, transitioning from the 2013 standard. So, what does that mean for customers using secure credit management software?
“It’s like a recipe for managing information security,” Davey explains. “If you follow it correctly (from processes to people), you end up with a well-structured and proven way to keep your organisation secure.”
The audit, conducted by an independent auditor, is far from a box-ticking exercise. Auditors interview teams across the organisation (from management to HR and DevOps) and ask for real evidence that every control is in place.
“They don’t just want to see policies,” Marc adds. “They want proof that what we say we do, we actually do.”
ISO certification is valid for three years, with yearly audits in between. But unlike many companies, Onguard doesn’t treat it as a once-a-year ritual.
“We have monthly meetings with management to review risks, incidents and improvements,” says Davey. “That continuous monitoring mindset keeps us sharp all year long.”
What’s ISAE 3402 and why does it matter for software security?
While ISO 27001 proves that Onguard’s security structure is in place, the ISAE 3402 Type II audit goes one step further, verifying that these controls work consistently over time.
“ISAE 3402 asks us to show evidence for every month of the past year,” Davey explains. “It’s about proving ongoing effectiveness, not just compliance. That’s especially relevant for our customers who rely on our systems for accurate financial data.”
Recently, Onguard has gone a step further by automating much of this process. Using advanced governance and compliance tools, the team can automatically track critical settings like two-factor authentication (2FA) and system configurations.
“Instead of checking something every six months, we now know instantly if a setting changes,” Marc says. “It’s a huge step towards real-time assurance.”
A takeaway note: Security is everyone’s job
For Davey and Marc, security is a shared responsibility.
“Too often, people start a project and think about security later. We want everyone to build it in from the start, whether it’s a new feature, a migration or a supplier contract.”
-Davey Heisen, Security Officer, Onguard.
“Lock your screen. Use a password manager. Ask questions before launching new tools. Small habits make a big difference.”
-Marc van Loon, Assistant Security Officer, Onguard.
This proactive culture is what makes Onguard stand out. From the junior developer to the Managing Director, security awareness runs through the organisation’s DNA.
Why this matters for CFOs and credit managers
If you’re a CFO, credit manager or finance leader, your world revolves around numbers: DSO, cash flow, working capital. But behind those numbers lies something even more important: trust.
“Every invoice reminder, payment link and customer record in Onguard’s credit management software is protected by layers of security that never sleep. Because healthy cash flow means nothing without healthy data,” Davey concludes.
Quick FAQs – Marc and Davey respond
1. What does ISO 27001 mean for security at Onguard?
“It’s an international standard for managing information security: basically, a recipe for doing it right. If you follow it properly, you end up with a well-structured and secure organisation. And the auditors come in every year to check if we really do what we say. It’s not just paperwork. We have to prove that our controls actually exist and work.”
2. What does the recent ISO 27001:2022 re-certification mean for customers?
“It proves we’re not standing still. Every year, we improve and adapt to new risks. It’s a reassurance that customer data is protected and that we take this responsibility seriously. It’s also a sign of management commitment. We have monthly meetings with our MT to discuss risks and improvements (not once a year like most companies).”
3. How does ISAE 3402 complement ISO 27001?
“ISO checks if controls exist. ISAE 3402 checks if they keep working throughout the year. We provide monthly evidence to prove that, so customers can trust the integrity of their financial data.”
4. What’s the role of Visma in Onguard software security?
“Being part of Visma gives us access to tools like dark web monitoring and a 24/7 Global Security Operations Center (GSOC). If something happens overnight, someone’s watching. We get a call only if it’s serious, which gives us peace of mind because security never sleeps.”
| Interested in knowing more about security at Onguard? Check out our security page or contact us directly. |
